{"id":"https://openalex.org/W4386688462","doi":"https://doi.org/10.1007/s10664-023-10354-3","title":"Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study","display_name":"Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study","publication_year":2023,"publication_date":"2023-09-01","ids":{"openalex":"https://openalex.org/W4386688462","doi":"https://doi.org/10.1007/s10664-023-10354-3"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-023-10354-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-023-10354-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-023-10354-3.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10664-023-10354-3.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077569016","display_name":"Goran Piskachev","orcid":"https://orcid.org/0000-0003-4424-5838"},"institutions":[{"id":"https://openalex.org/I4210089985","display_name":"Amazon (Germany)","ror":"https://ror.org/00b9ktm87","country_code":"DE","type":"company","lineage":["https://openalex.org/I1311688040","https://openalex.org/I4210089985"]},{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Goran Piskachev","raw_affiliation_strings":["Amazon Web Services, Berlin, Germany","Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-4424-5838","affiliations":[{"raw_affiliation_string":"Amazon Web Services, Berlin, Germany","institution_ids":["https://openalex.org/I4210089985"]},{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104993212","display_name":"Matthias Becker","orcid":null},"institutions":[{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Matthias Becker","raw_affiliation_strings":["Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076678278","display_name":"Eric Bodden","orcid":"https://orcid.org/0000-0003-3470-3647"},"institutions":[{"id":"https://openalex.org/I206945453","display_name":"Paderborn University","ror":"https://ror.org/058kzsd48","country_code":"DE","type":"education","lineage":["https://openalex.org/I206945453"]},{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Eric Bodden","raw_affiliation_strings":["Department of Computer Science, Paderborn University, Paderborn, Germany","Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Paderborn University, Paderborn, Germany","institution_ids":["https://openalex.org/I206945453"]},{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5077569016"],"corresponding_institution_ids":["https://openalex.org/I4210089985","https://openalex.org/I4210093498"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":1.0692,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":{"value":0.75925698,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"28","issue":"5","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.6453744173049927},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6142828464508057},{"id":"https://openalex.org/keywords/personalization","display_name":"Personalization","score":0.5285208225250244},{"id":"https://openalex.org/keywords/scope","display_name":"Scope (computer science)","score":0.517082691192627},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.48798125982284546},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.44968879222869873},{"id":"https://openalex.org/keywords/population","display_name":"Population","score":0.43392127752304077},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3339175879955292},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3206775188446045},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.212861567735672},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.0929425060749054}],"concepts":[{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.6453744173049927},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6142828464508057},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.5285208225250244},{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.517082691192627},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.48798125982284546},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.44968879222869873},{"id":"https://openalex.org/C2908647359","wikidata":"https://www.wikidata.org/wiki/Q2625603","display_name":"Population","level":2,"score":0.43392127752304077},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3339175879955292},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3206775188446045},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.212861567735672},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0929425060749054},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C149923435","wikidata":"https://www.wikidata.org/wiki/Q37732","display_name":"Demography","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s10664-023-10354-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-023-10354-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-023-10354-3.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:publica.fraunhofer.de:publica/469724","is_oa":false,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/469724","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.1007/s10664-023-10354-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-023-10354-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-023-10354-3.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.46000000834465027,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[{"id":"https://openalex.org/G5743991854","display_name":null,"funder_award_id":"ERDF-0801379","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"}],"funders":[{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4386688462.pdf"},"referenced_works_count":25,"referenced_works":["https://openalex.org/W240302486","https://openalex.org/W1969785126","https://openalex.org/W2017025011","https://openalex.org/W2130758759","https://openalex.org/W2514084604","https://openalex.org/W2519392667","https://openalex.org/W2646484260","https://openalex.org/W2749587018","https://openalex.org/W2762682773","https://openalex.org/W2795566764","https://openalex.org/W2803054784","https://openalex.org/W2853432192","https://openalex.org/W2888223970","https://openalex.org/W2940466285","https://openalex.org/W2961642335","https://openalex.org/W2964817188","https://openalex.org/W2972976146","https://openalex.org/W3031020798","https://openalex.org/W3217224160","https://openalex.org/W4233410239","https://openalex.org/W4239863959","https://openalex.org/W4244726870","https://openalex.org/W4254666025","https://openalex.org/W4281737341","https://openalex.org/W4299818415"],"related_works":["https://openalex.org/W2108595774","https://openalex.org/W3202376248","https://openalex.org/W2387713776","https://openalex.org/W2081035100","https://openalex.org/W2278173804","https://openalex.org/W3206324740","https://openalex.org/W2372799935","https://openalex.org/W2026901334","https://openalex.org/W4226151304","https://openalex.org/W4221142711"],"abstract_inverted_index":{"Abstract":[0],"The":[1,164,243],"use":[2],"of":[3,35,45,70,76,83,96,156,216,220,233],"static":[4],"analysis":[5,50,86,129,254],"security":[6,31,144,178],"testing":[7],"(SAST)":[8],"tools":[9,37,54,100,172,183,205],"has":[10],"been":[11],"increasing":[12],"in":[13,56,159,176],"recent":[14],"years.":[15],"However,":[16],"previous":[17],"studies":[18],"have":[19,200],"shown":[20],"that,":[21],"when":[22,101],"shipped":[23],"to":[24,147,206,252],"end":[25],"users":[26,139,168,199,235],"such":[27,73],"as":[28,74],"development":[29,106,142],"or":[30,48,81],"teams,":[32],"the":[33,53,57,84,93,104,112,150,160,182,187,203,217,234,239,253],"findings":[34],"these":[36],"are":[38,173,247],"often":[39],"unsatisfying.":[40],"Users":[41],"report":[42],"high":[43],"numbers":[44],"false":[46],"positives":[47],"long":[49],"times,":[51],"making":[52],"unusable":[55],"daily":[58],"workflow.":[59],"To":[60],"address":[61],"this,":[62],"SAST":[63,99,171,204,223],"tool":[64,211],"creators":[65],"provide":[66,207],"a":[67,121,133,231],"wide":[68],"range":[69],"configuration":[71,94,113,218,240,244],"options,":[72],"customization":[75],"rules":[77],"through":[78],"domain-specific":[79],"languages":[80],"specification":[82],"application-specific":[85],"scope.":[87,255],"In":[88],"this":[89,154],"paper,":[90],"we":[91,194],"study":[92,136,158],"space":[95],"selected":[97],"existing":[98],"used":[102],"within":[103],"integrated":[105],"environment":[107],"(IDE).":[108],"We":[109,131],"focus":[110],"on":[111,191],"options":[114,219,241,245],"that":[115,167,198,230,246],"impact":[116],"three":[117],"dimensions,":[118],"for":[119,153,210],"which":[120],"trade-off":[122],"is":[123],"unavoidable,":[124],"i.e.,":[125],"precision,":[126],"recall,":[127],"and":[128,143,226],"runtime.":[130],"perform":[132],"between-subjects":[134],"user":[135,157],"with":[137],"40":[138],"from":[140],"multiple":[141],"teams":[145],"-":[146],"our":[148],"knowledge,":[149],"largest":[151],"population":[152],"kind":[155],"software":[161],"engineering":[162],"community.":[163],"results":[165],"show":[166],"who":[169],"configure":[170],"more":[174],"effective":[175],"resolving":[177],"vulnerabilities":[179],"detected":[180],"by":[181],"than":[184],"those":[185],"using":[186],"default":[188],"configuration.":[189],"Based":[190],"post-study":[192],"interviews,":[193],"identify":[195],"common":[196],"strategies":[197],"while":[201],"configuring":[202],"further":[208],"insights":[209],"creators.":[212],"Finally,":[213],"an":[214],"evaluation":[215],"two":[221],"commercial":[222],"tools,":[224],"Fortify":[225],"CheckMarx":[227],",":[228],"reveals":[229],"quarter":[232],"do":[236],"not":[237],"understand":[238],"provided.":[242],"found":[248],"most":[249],"useful":[250],"relate":[251]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}